{"id":"CVE-2026-52918","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: serialize accept_q access\n\nbt_sock_poll() walks the accept queue without synchronization, while\nchild teardown can unlink the same socket and drop its last r…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: serialize accept_q access\n\nbt_sock_poll() walks the accept queue without synchronization, while\nchild teardown can unlink the same socket and drop its last r…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 2.6.12.1, < 5.10.259","linux_kernel >= 5.11, < 5.15.210","linux_kernel >= 5.16, < 6.1.176","linux_kernel >= 6.2, < 6.6.142","linux_kernel >= 6.7, < 6.12.92","linux_kernel >= 6.13, < 6.18.34","linux_kernel >= 6.19, < 7.0.11","linux_kernel = 2.6.12","linux_kernel = 7.1"],"patched":["linux_kernel 7.0.11"],"published":"2026-06-24","updated":"2026-10-15","sourceUpdated":"2026-10-15T02:19:56.497","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-52918","references":[{"url":"https://git.kernel.org/stable/c/41c8c1c7923e86e0eb59cfb4279349112756a336","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4ec17782fd186f901a7329605d11048b085b945a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/85f8674cae82053f1e6bab295f6a8422cca14db5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b4c412e001b0c670eb937beab491af974da55b3","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a218bf69eb51fefe59a3976fa8925261141f681c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/be43e6b4043113c3b3cf887c3c8350f67140274c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d9ce4de05df2385c19e2c7d12f529144e1a44af1","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e83f5e24da741fa9405aeeff00b08c5ee7c37b88","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00262,"epssPercentile":0.1679,"ingestedAt":"2026-10-15T03:30:12.902Z","slug":"CVE-2026-52918","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: serialize accept_q access\n\nbt_sock_poll() walks the accept queue without synchronization, while\nchild teardown can unlink the same socket and drop its last reference.\nThe unsynchronized accept queue walk has existed since the initial\nBluetooth import.\n\nProtect accept_q with a dedicated lock for queue updates and polling.\nAlso rework bt_accept_dequeue() to take temporary child references under\nthe queue lock before dropping it and locking the child socket.\n\n## Affected\n\n- `linux_kernel >= 2.6.12.1, < 5.10.259`\n- `linux_kernel >= 5.11, < 5.15.210`\n- `linux_kernel >= 5.16, < 6.1.176`\n- `linux_kernel >= 6.2, < 6.6.142`\n- `linux_kernel >= 6.7, < 6.12.92`\n- `linux_kernel >= 6.13, < 6.18.34`\n- `linux_kernel >= 6.19, < 7.0.11`\n- `linux_kernel = 2.6.12`\n- `linux_kernel = 7.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.0.11`","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}